find-new-curators
Fail
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation file
first-batch.mdcontains references tohttps://concretexyz.pro/andhttps://termmax.org/. These URLs have been flagged by automated scanners as malicious, specifically associated with CryptScam activities and appearing on domain blacklists. - [COMMAND_EXECUTION]: The skill instructions frequently invoke local Python scripts and tests using
poetry run python(e.g.,.claude/skills/find-new-curators/scripts/print-existing-curators.py). This is standard for development-oriented skills from this author but relies on the execution of local code in the user's environment. - [DATA_EXFILTRATION]: The skill performs network operations to fetch metadata from external DeFi APIs, including
blue-api.morpho.org/graphqlandapp.lagoon.finance/api/vault. While these are well-known industry services, they involve data ingestion from external network sources. - [PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from vault names, symbols, and descriptions (indirect prompt injection surface). Maliciously crafted metadata in a vault could attempt to influence the agent's curator identification heuristics, though the current instructions include verification steps to mitigate this.
Recommendations
- CRITICAL: 1 infected file(s) detected - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata